Hello all, new poster here. I have a csv file with a column full of Splunk queries. I am trying to enrich my Splunk instance with the data from the csv file via the following command: index="index1"
[ inputlookup rules.csv
| eval search = if(boolean=="FALSE","\""+rule+"\"",rule)
| return 10000 $search]
| fields _time index
| eval time_token = "_time=" + _time
| eval index_token = "index=" + index
| stats values(time_token) AS time_token values(index_token) AS index_token
| eval time_token=mvjoin(time_token," OR ")
| eval index_token=mvjoin(index_token," OR ")
| append
[ inputlookup rules.csv
| eval rule = if(boolean=="FALSE","\""+rule+"\"",rule)
| return 10000 $rule]
| eventstats first(time_token) AS time_token first(index_token) AS index_token
| search rule=*
| map maxsearches=100 search="search
[| makeresults
| eval search= \"$time_token$ $index_token$ $rule$\"
| return $search]
| eval rule_found=\"$rule$\", rule_id=\"$id$\"" The problem I am having is with the "map" command. everything after the second "search" is greyed out and not being included in the search. I have been able to get the following portion of the code working: index="index1"
[ inputlookup rules.csv
| eval search = if(boolean=="FALSE","\""+rule+"\"",rule)
| return 10000 $search]
| fields _time index
| eval time_token = "_time=" + _time
| eval index_token = "index=" + index
| stats values(time_token) AS time_token values(index_token) AS index_token
| eval time_token=mvjoin(time_token," OR ")
| eval index_token=mvjoin(index_token," OR ")
| append
[ inputlookup rules.csv
| eval rule = if(boolean=="FALSE","\""+rule+"\"",rule)
| return 10000 $rule]
| eventstats first(time_token) AS time_token first(index_token) AS index_token
| search rule=* Thank you for any suggestions you have to get this search working.
... View more
